Reforming India's Cybersecurity Architecture

Reforming India's Cybersecurity Architecture

#GS-3 #Science & Technology #Cyber Security #Role of External State & Non-State Actors #Challenges to Internal Security Through Communication Networks #Governance & Social Justice #Current Events #National

Key takeaways

  • India faces rising cyber threats, with Seqrite Labs detecting over 4,21,000 ransomware variants across enterprise systems.
  • The I4C helpline network saved over Rs 11,158 crore across 32.80 lakh complaints by June 2026.
  • Telecom fraud checks using ASTR resulted in the disconnection of over 88 lakh fake mobile connections by July 2026.
  • Budget utilization remains low, as MeitY spent only Rs 211 crore out of its allocated Rs 759 crore during 2024-25.
  • India suffers from a severe talent shortage, needing nearly 39,000 skilled cybersecurity professionals to protect critical systems.

Why in News

  • A recent advisory from CERT-In highlights major security gaps across government and private IT systems in India.
  • Autonomous AI tools and open-source software are creating unexpected vulnerabilities that evade ordinary security checks.
  • Cybersecurity expert Jim Langevin points out that real digital security is an ongoing process rather than a one-time product.
  • India needs proactive defenses, flexible regulations, and better teamwork among government agencies to stay safe online.

Challenges

  • The spread of Generative AI allows hackers to launch fast, automated social engineering attacks that outpace traditional defenses.
  • Criminals use deepfake voices and LLMs in local languages to execute complex voice-cloning, SIM-swapping, and large-scale phishing scams.
  • In June 2026, fraudsters used a cloned voice of a company director to steal over Rs 10 crore across 63 bank accounts.
  • Ransomware attacks like Xelera and Weaxor directly target industrial control systems, power grids, and hospital networks.
  • Security firm Seqrite Labs detected over 4,21,000 ransomware variants targeting Indian business systems.
  • A major cyberattack on AIIMS New Delhi locked records of 3 to 4 crore patients and shut down digital health services for days.
  • API security flaws like Broken Object Level Authorization (BOLA) expose citizen records across UPI, Aadhaar, DigiLocker, and CoWIN.
  • BOLA flaws in public portals like CoWIN allowed unauthenticated users to query sensitive personal data using modified scripts.
  • State-sponsored actor groups like APT36 and SideCopy target India's defense, satellite, and energy networks using zero-day exploits.
  • A targeted cyber campaign attacked DRDO and regional power grids using fake official emails to install specialized spyware.
  • Hackers bypass firewalls by attacking weak third-party software vendors, IT service providers, and open-source tools.
  • A supply-chain attack at C-Edge Technologies forced authorities to disconnect nearly 300 cooperative and regional rural banks from payment systems.
  • Fraudsters exploit contactless payments, FASTags, and UPI through NFC relay attacks, token hijacking, and fake QR codes.
  • Cybercrime networks in Jamtara and Mewat distribute fake utility payment apps to hijack UPI tokens and steal savings.
  • Poorly configured cloud storage buckets and weak multi-factor checks lead to major corporate data leaks.
  • Exposed cloud databases leaked records from stockbroker Angel One and over 2,80 million UAN records from the provident fund system.
  • Millions of unpatched IoT devices in smart meters and municipal networks are hijacked to launch massive DDoS attacks.
  • Hackers controlled unpatched cameras and smart meters across Indian cities to launch targeted attacks against telecom web portals.
  • In October 2026, CERT-In documented cases where autonomous Agentic AI tools illegally accessed private corporate data.
  • Advanced AI attack tools compressed the time needed for a full cyber intrusion from several days down to just a few hours.

India's Cybersecurity Initiatives

  • Under Section 70B of the Information Technology Act, 2000, CERT-In operates as the main agency for handling digital threats.
  • Rules issued in 2022 require covered organizations to report cyber incidents within 6 hours and store IT logs for 180 days.
  • The National Cyber Coordination Centre and CyMAC help military, telecom, and intelligence agencies coordinate threat responses.
  • The I4C links the 1930 helpline with the National Cyber Crime Reporting Portal to freeze stolen funds rapidly.
  • By June 2026, this financial fraud network saved over Rs 11,158 crore across 32.80 lakh complaints.
  • The Department of Telecommunications uses the AI tool ASTR to find and block fake mobile connections across the country.
  • By July 2026, telecom authorities disconnected over 88 lakh fake mobile connections that failed identity re-verification checks.
  • Citizens can report suspicious messages through Chakshu on the Sanchar Saathi portal, while DIP shares intelligence with financial firms.
  • The NCIIPC operates under Section 70A of the IT Act, 2000 to shield the country's critical digital systems.
  • Specialized groups like CSIRT-Power perform security audits, threat assessments, and vulnerability fixes for the national electricity grid.
  • In February 2026, CERT-In and SIA-India launched a dedicated cybersecurity framework for space and satellite communication networks.
  • Technical advisories on Software Bills of Materials (SBOMs) help organizations track foreign components in their software and hardware.
  • In May 2026 and June 2026, CERT-In published guidelines on AI vulnerability testing, patch management, and automated incident response.
  • The Samanvaya platform connects police departments across state borders, while Pratibimb maps out the locations of active cybercriminals.
  • Special Joint Cyber Coordination Teams handle complex inter-state crimes operating out of hotspots like Jamtara and Mewat.
  • Digital forensic labs are active in 33 States and Union Territories under the Cyber Crime Prevention against Women and Children scheme.
  • An advanced digital forensic support center became operational in Assam in August 2025 to help police solve complex online crimes.
  • The Cyber Commando program trains specialists for high-level threats, with 281 personnel trained by August 2026.
  • Over 1,63 lakh police and judicial officers joined the CyTrain Platform by June 2026 to learn digital evidence handling.
  • Between June 2026 and July 2026, CERT-In ran 10 cyber drills involving 1,470 experts from 345 organizations.
  • The Cyber Swachhta Kendra provides free botnet cleanup tools, recording 89.55 lakh downloads by December 2025.
  • In September 2025, CERT-In issued 15 Elemental Cyber Defense Controls to help small businesses secure their networks.

Critical Gaps in Existing Architecture

  • Police powers remain divided by state boundaries, making cross-border cyber investigations slow and difficult.
  • A Parliamentary Standing Committee report in August 2026 noted that states revoking CBI consent hinders major cyber investigations.
  • Cyber laws remain spread across many old statutes, making prosecution confusing for courts and law enforcement agencies.
  • Cybersecurity funds remain heavily underused, with MeitY spending only Rs 211 crore out of Rs 759 crore in 2024-25.
  • India faces a massive shortage of nearly 39,000 skilled cybersecurity professionals, particularly in specialized fields like IoT security.
  • Out of over Rs 9,079 crore frozen in bank accounts, only over Rs 206 crore reached victims between 2023 and 2026.
  • Getting evidence from foreign social media platforms and cloud providers remains extremely slow due to outdated MLAT processes.
  • Online platforms lack uniform complaint formats, clear redressal timelines, and proper verification of commercial advertisers.

Way Forward

  • India must publish a clear national strategy with fixed deadlines, progress tracking, and unified command during major cyber incidents.
  • The central government should offer multi-year grants to help weaker states set up shared security centers for local hospitals and offices.
  • Essential public services like water, electricity, and health must build offline backup protocols so operations continue during cyberattacks.
  • Governments should establish dedicated career tracks, paid apprenticeships, and university labs to train specialized cyber professionals.
  • Public procurement rules must mandate SBOMs, mandatory software updates, and strict human controls over automated AI tools.
  • India needs an integrated digital pathway connecting initial police complaints, bank account freezes, and fast court refunds for victims.